alienbot | 0b5e264d4bda3add9a8a4fcc61ce00246779c0ac1bbfae9c916b1a1bf70c08b8 | Triage

Analysis

max time kernel
4079867s
max time network
143s
platform
android_x86
resource
android-x86-arm
submitted
13/02/2022, 12:51

Sharing

Report Analysis Logs

General

Target

0b5e264d4bda3add9a8a4fcc61ce00246779c0ac1bbfae9c916b1a1bf70c08b8.apk
Size

2.2MB
MD5

7617ebfa9f6b75d315e8a9583f2d4c12
SHA1

479af89042449442afda5c14344f4525c5404f3b
SHA256

0b5e264d4bda3add9a8a4fcc61ce00246779c0ac1bbfae9c916b1a1bf70c08b8
SHA512

fad40360bd78a372c0ffc46dc144a0cfd2c7c4a94cc642d55cdf51adf18bb799ad230eec445ac0d39c58eceed95700fe6d0667ca38584f9cffe5bc8ed32b333f

Score

10^/10

alienbot banker infostealer trojan

Malware Config

Extracted

Family

alienbot

C2

http://installerflas326435.xyz

Signatures

Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
banker trojan infostealer alienbot

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	njjmeghykw.okfhgnxldu.bncr

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/njjmeghykw.okfhgnxldu.bncr/app_DynamicOptDex/JtWo.json	5048	njjmeghykw.okfhgnxldu.bncr
/data/user/0/njjmeghykw.okfhgnxldu.bncr/app_DynamicOptDex/JtWo.json	5088	/system/bin/dex2oat
/data/user/0/njjmeghykw.okfhgnxldu.bncr/app_DynamicOptDex/JtWo.json	5048	njjmeghykw.okfhgnxldu.bncr

njjmeghykw.okfhgnxldu.bncr
1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
PID:5048
- njjmeghykw.okfhgnxldu.bncr
  2⤵
  PID:5088
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads